Method and apparatus for controlling traffic between different entities on a network

Abstract

A method for controlling traffic between different entities on a network in which packets of received data are inspected, and if encapsulated, are decapsulated layer by layer and, after each layer is decapsulated, the packet is inspected to determine if the packet is to be acted upon or discarded. Apparatus for controlling traffic between different entities on a network in accordance with a predetermined policy, the policy being applied to network traffic being passed between logical zones, wherein each logical zone can be simultaneously associated with one or more types of network entity and in particular t at least one of said source and destination zones includes both physical entities and logical entities,

Description

BACKGROUND TO THE INVENTION [0001] The present invention relates to a method and apparatus for controlling traffic between different entities on a network. [0002] We define “network entity” in this matter as including various types of entity such as; [0003] physical entities comprising IP addresses, ports, devices, remote or local networks or sub networks VLANs, and [0004] logical entities such as tunnels (of various protocols such as IPSec (Internet Protocol Security (IETF)) and GRE (Generic Router Encapsulation) tunnels), internet, items relating to the time of receipt of the packet, or the application (e.g. TCP / UDP IP services such as HTTP, SMTP), or number of bytes in the packet or the rate of receipt of traffic etc. [0005] A router which applies network traffic policy (such as a firewall router) applies a defined network traffic policy between different physical addresses, e.g. different IP addresses of devices on a network. Effectively, it will only allow access between addres...

AI Technical Summary

Benefits of technology

[0012] Thus the packet of data is thoroughly inspected before forwarding which improves security.

[0027] Generally, prior arrangements only inspect the packet when it has been completely decapsulated by examining the data. It will be understood that by the use of an iteration (by repeating steps (b), (c) and (d)) of this aspect of the invention, by the decapsulation of the packet and inspecting the packet at each decapsulation, greater security can be provided to avoid forwarding packets containing unwanted data.

[0043] An advantage of this arrangement is that it allows great flexibility in adding to the logical security zone without changing the policies. For example, if there is a zone which we can refer to as the “sales department” zone, it is possible to add a remote sales departments via a VLAN or tunnel simply by adding the VLAN or tunnel attributes to the “sales department” zone without amending the policy and so the remote sales force will then have the same access to the network as the local sales force.

[0055] Thus a logical security zone's network locations may also be updated without modifying actual policy configuration, simplifying the task of migrating to a new network configuration. Future network locations can be added to a logical security zone without changing the policy configuration.

Problems solved by technology

Hitherto, policy configuration is complex and a policy needs to be modified to support new types of network entities.

In such devices, policy configuration is complex.

There are also problems in dealing with packets of data from VLANs or tunnel which are encapsulated.

Images